Stitcha

Privacy notice

What personal information we collect, where it comes from, what we do with it, who we share it with, how long we keep it, and the rights you have. We have tried to keep it plain.

Last updated 15 October 2026

The short version

We are Stitcha UK Limited, trading as Stitcha. We run online clothing stores for charities, clubs and community groups.
If you are the contact for an organisation, we may have found its public contact details (for example on the Charity Commission’s register or its own website) and used them to make a private preview store and email you about it. Reply “no thanks” and we won’t contact you again.
If you buy from a store, we use your details to take payment through Stripe, make and deliver your order, and keep our accounts. The organisation the store is for can see your name, your email address and what you ordered.
We don’t sell personal information, we don’t use advertising cookies, and we don’t send you marketing unless you have asked for it.
You can ask to see, correct or delete your information, or object to how we use it, by emailing [email protected].

1. Who we are

Stitcha is a trading name of Stitcha UK Limited, a company registered in England and Wales with company number 17296304. Our registered office is:

Henwood House, Henwood, Ashford, Kent, TN24 8DH, United Kingdom

We are the “controller” of the personal information described here, which means we decide how it is used and are responsible for it. To contact us about privacy, email [email protected] or write to our registered office.

This notice covers the Stitcha website (stitcha.co.uk, which you may also reach at stitcha-communities.pages.dev), the stores we run on it, each at its own address such as your-organisation.stitcha.co.uk, our app for designing a store, and the emails we send.

2. What we collect

If you are the contact for an organisation we get in touch with

The organisation’s name, charity number (if it has one), address, website and logo.
A contact email address the organisation publishes. This may be a named work address (such as [email protected]), and we may take a first name from it or from the organisation’s public pages to greet you.
Public information about the organisation’s upcoming events.
Whether, when and how often the private preview link we send has been opened (not who opened it), and anything you tell us when you reply.

Where it comes from: public sources. See section 4.

If you claim a store for your organisation

Your name, your role in the organisation and your email address.
The organisation’s legal name, charity number (if it has one) and registered address.
The amount per item you chose for the organisation, and the agreement you signed, with the record of signing: the date and time, and the internet (IP) address, browser and country it was signed from.
The one-time codes we email you to confirm your address. We keep only a scrambled version of each code, never the code itself.
If you set up payouts, Stripe collects the information it needs about the organisation, the people who run it and its bank account. Stripe’s own privacy notice applies to that.

Where it comes from: you, and the organisation’s details you give us.

If you buy from a store

Your name, email address and delivery address.
What you ordered, including sizes and any names or numbers you ask us to print.
Whether your card has been reserved, charged, released or refunded. You enter your card details on Stripe’s secure payment page: we never see or store your full card number.
Any messages you send us about your order.

If you use our app, make a store or create an account

Your email address and password if you create an account. Your password is stored scrambled (hashed) by our database provider, so we never see it.
Your name and email address if you make a store, and the designs and logos you upload or save.
What you type into the app’s setup assistant, if you use it.
The details you give us if you send an enquiry.

Everyone who visits the site

How the site is used: which pages and steps you visit, whether you are on a phone or a computer, and a random ID kept in your browser so we can tell one visit from another. We don’t store your IP address with it, and private preview stores don’t record it at all.
Like any website, our hosting provider handles your IP address to deliver pages to you, and we use it briefly to stop the site being flooded with requests.

3. Why we use it, and our lawful basis

Data protection law says we need a lawful basis for each use of personal information. These are ours.

What we do

Lawful basis

What we doFind organisations that might want a store, make them a private preview and email them about it.

Lawful basisOur legitimate interests (explained in section 4).

What we doCheck you control the email address you give, run the claim, record the agreement with your organisation and open its store.

Lawful basisThe contract with your organisation; our legitimate interest in dealing with the person who acts for it; and, for a charity, our legal obligation under the Charities Act 1992 to have a signed agreement and keep records the charity can inspect.

What we doTake your order, reserve or charge your card, make and deliver your order, handle returns and refunds, and email you about it.

Lawful basisContract: we need it to sell to you.

What we doShow the organisation a store is for who has ordered (name, email address and order).

Lawful basisOur legitimate interests and the organisation’s: it needs to answer questions and hand out orders. Our agreement with it limits what it may do with your details.

What we doPay organisations the amounts their stores raise.

Lawful basisThe contract with the organisation, and for a charity our legal obligations under charity law.

What we doKeep accounts, tax records and the records charity law requires.

Lawful basisLegal obligation.

What we doKeep the site and our stores secure, and prevent fraud and misuse.

Lawful basisOur legitimate interests.

What we doUnderstand how the site is used so we can improve it.

Lawful basisOur legitimate interests.

What we doProvide the app, your account and the setup assistant.

Lawful basisContract: providing the service you asked for.

What we doKeep a note that you don’t want to hear from us.

Lawful basisOur legitimate interest in respecting your wishes.

We don’t make decisions about you by automated means that have legal or similarly significant effects on you.

4. How we find and contact organisations

This section is for people whose details we did not get from them directly.

Where we found your details

We look for charities, clubs and community groups that might like their own clothing store. We use the Charity Commission’s register of charities, which the Commission publishes as open data, the organisation’s own website, and other public listings. From these we note the organisation’s name, logo and published contact email and, where it has published one, an upcoming event.

What we do with them

We make a private preview store showing the organisation’s name and logo, and email the organisation a link to it. Only people with the link can see the preview; it is not listed, search engines are asked not to index it, and nothing can be bought from it. A preview that nobody claims stays available until the organisation removes it (the preview has a button to do this) or asks us to, or we take it down. When a preview is removed, its link stops working and the logo is deleted from it.

A preview store may also hold other versions of your organisation’s logo that we found on your own website, such as a square version or the symbol from your logo. They stay private to your preview and are deleted when the preview is removed, expires or opens as a live store.

We keep our list of organisations in Google Drive (Google Sheets), and we use AI assistants from OpenAI and Anthropic to help us research organisations and prepare the previews and emails. The emails are sent by a person, not automatically.

Our legitimate interest, and why we think it is fair

We have a legitimate interest in offering our service to organisations that could benefit from it. We think using public details in this way is fair, and does not override your rights, because:

we use only contact details the organisation has published so that people can get in touch with it;
we contact the organisation about its own store, which it is under no obligation to use;
we tell you where we found your details and link to this notice in our first email; and
saying no is easy, and we stop straight away.

Where the address is a named person’s work address, the effect on that person is small: an email at work about their organisation.

Saying no

Reply “no thanks” to our email, or email [email protected], and we won’t contact you again. We keep a short record (the organisation, the email address and the date) so that we don’t contact you again by mistake. You can also ask us to delete the preview store and the details we hold about you, and to tell you what we hold.

We don’t sell personal information. We share it only with the people and companies below, and only what each needs. The service providers act on our instructions under contracts that require them to protect it.

Cloudflare hosts the website and our back-end services, stores logos, designs and order files, and delivers the pages to you.
Supabase runs our database and account sign-in. Our database is hosted in the European Union (Ireland).
Stripe handles card payments, card reservations and refunds, and payouts to organisations (Stripe Connect). Stripe is also responsible in its own right for some information it collects, for example to prevent fraud and to check who it is paying; see Stripe’s privacy notice.
Resend sends our emails, such as order emails and one-time codes.
Anthropic provides the AI behind the app’s setup assistant, if you use it, and an AI assistant we use to prepare outreach.
OpenAI provides an AI assistant we use to prepare outreach.
Google provides the site’s fonts (your browser downloads them from Google, which receives your IP address), and Google Drive, where we keep our list of organisations.
jsDelivr, unpkg and cdnjs deliver some of the code libraries our app uses; your browser downloads them, so they receive your IP address.
Our production partners, who print or embroider garments and deliver orders, get what they need to make and deliver them. So does the supplier of our garments, which packs each order separately for them: for each order, the buyer’s name, phone number, email address and delivery address, and the order reference, so that each order reaches the right person. The supplier does not contact buyers.
The organisation a store is for sees the name and email address of each buyer and what they ordered, as explained in section 3.
Professional advisers, such as our lawyers and accountants, and authorities where the law requires it (for example HM Revenue & Customs, the Charity Commission, the Fundraising Regulator or the police).
A buyer of our business, if we sell all or part of it, who would have to use the information as this notice says.

6. Transfers outside the UK

Some of these providers are based in, or reach data from, the United States or other countries outside the UK. When personal information goes outside the UK, we make sure it is protected: either the country is covered by UK “adequacy” regulations (the European Union is, and so are US companies certified under the UK extension to the EU–US Data Privacy Framework), or the provider has signed the UK’s International Data Transfer Agreement or Addendum as part of its data protection terms. Email us if you would like more detail.

7. How long we keep it

Information

How long

InformationOrganisations’ contact details used for outreach

How longUp to 12 months after we last contacted the organisation, unless it claims a store.

Information“No thanks” records

How longFor as long as we contact organisations, so that we keep respecting your wishes.

InformationPrivate preview stores nobody claims

How longUntil the organisation removes the preview (it has a button to do this) or asks us to, or we take it down. Then the link stops working and the logo is deleted. The preview’s organisation name and charity number stay with our outreach records.

InformationSigned agreements and the record of signing

How longAt least six years after the store closes, because charity law lets the charity inspect them and they show what was agreed if there is a dispute. They cannot be changed once signed.

InformationOrders and payments

How longSix years after the end of the financial year of the order, as tax law requires. Two years after a finished order, our system removes the buyer’s name, email address, phone number and delivery address from our main order record; what was bought, the price and the date stay in our accounts.

InformationAccounts, saved designs and logos

How longWhile your account is open. Ask us and we will delete them, unless we must keep something for an order or agreement.

InformationFull-size original logo files

How longWhen you upload a large logo, we also keep a full-size copy of it, so that big prints come out sharp. We keep it for five years after it was last used (uploaded again, or used in a store, a preview, an order or a saved design), and for as long as an open store, a preview or an order still being made uses it. Then we delete it. The print files we make for an order or a store hold a copy of it too, and are kept with that order or store.

InformationOne-time codes

How longThey expire quickly (within two hours at most), and our clean-up deletes old ones.

InformationUsage statistics

How longFor as long as they help us understand how the site is used. They are not linked to your name or email address.

InformationEmails and messages

How longAs long as we need them to deal with what you asked, or as long as the order or agreement they relate to.

8. Cookies and browser storage

We don’t use advertising cookies or third-party tracking. The site keeps a few things in your browser’s storage so that it works: your bag, your sign-in, a private preview link you have opened, the referral code of a link you followed, and the random ID for our own usage statistics. You can clear them at any time in your browser settings; clearing the usage ID doesn’t stop the site working.

Some store pages, including preview stores we make for organisations, show posts from the organisation’s public Instagram account. Those posts load directly from Instagram, a Meta service, so while you view such a page Instagram may set cookies or collect information about your visit under Meta’s privacy policy, not this one. We don’t receive that information.

9. Keeping it safe

We protect personal information with measures such as encrypted connections, access controls on our systems and data, and keeping security codes only in scrambled form. No way of sending or storing information is completely secure, but we work to keep yours safe and would tell you, and the regulator where required, about a breach that puts you at risk.

10. Your rights

You have the right to:

see the personal information we hold about you and get a copy of it;
have it corrected if it is wrong or incomplete;
have it deleted, where we have no good reason to keep it;
restrict how we use it while a question about it is sorted out;
object to our using it on the basis of legitimate interests. You can always object to direct marketing, and we will stop;
move information you gave us to another organisation (data portability), where we use it on the basis of a contract.

To use any of these rights, email [email protected]. It is free. We will reply within one month, and may ask you to confirm who you are first. Some rights have limits; for example, we must keep order and agreement records for as long as the law requires, and we will explain if that applies.

11. Complaints

If you are unhappy with how we have used your information, please tell us first at [email protected] so we can put it right.

You can also complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

12. Changes to this notice

We will update this page when what we do changes, and change the date at the top. If a change affects you significantly, we will tell you before it takes effect.

This notice was last updated on 15 October 2026.